Nikto User Agent Change

by Vince
in Blog
Hits: 11586

Nikto is a great tool for scanning web servers for vulnerabilities but if you look at the logs, you can see its footprint:

"Mozilla/5.00 (Nikto/2.1.6) (Evasions:None) (Test:Port Check)"

...which makes it simple to block. To change Nikto's user agent, we open the configuration file found in /etc/nikto.conf

At the top of the configuration file, we find:

# User-Agent variables:
# @VERSION - Nikto version
# @TESTID - Test identifier
# @EVASIONS - List of active evasions
USERAGENT=Mozilla/5.00 (Nikto/@VERSION) (Evasions:@EVASIONS) (Test:@TESTID)

If we change it to this instead:

# User-Agent variables:
# @VERSION - Nikto version
# @TESTID - Test identifier
# @EVASIONS - List of active evasions
USERAGENT=Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36

When we look in the logs, we see this:

xx.xx.xx.xx - - [10/Jul/2017:14:59:01 -0700] "GET / HTTP/1.1" 200 27097 "-" "Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/59.0.3071.115 Safari/537.36"

Instead of this:

xx.xx.xx.xx - - [10/Jul/2017:14:57:37 -0700] "HEAD / HTTP/1.1" 200 465 "-" "Mozilla/5.00 (Nikto/2.1.6) (Evasions:None) (Test:Port Check)"